v8/test/mjsunit/array-join-element-tostring-prototype-side-effects.js

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

(function ArrayPrototypeChanged() {
  const el = {
    toString() {
      Array.prototype[1] = '2';
      return '1';
    }
  };
  const a = [el, ,3];
  assertSame("123", a.join(''));
})();